|
|
Post by ellynmacg on Jul 3, 2020 18:56:37 GMT
...log in as EllynMacG? The new 'puter has the name I used briefly on this site (tobian), but does not recognize Ellyn. Should I just say I forgot my password (which is actually the case), or is there a better way?
|
|
|
|
Post by mslo79 on Jul 4, 2020 2:51:11 GMT
Trust me, use a password manager (which are free) and make a backup copy of the database and keep it somewhere safe. so this way even if your computer dies out of no where, you can easily restore your password managers database file.
with a password manager all you have to do is remember one good password which will then give you access to each and every site you use to log into online and each will have a random/secure password. because it's very unwise to use the same so-so password across multiple websites, especially on stuff you care about like banking etc, because if someone gets a hold of a password through a website being compromised they could potentially use it to compromise other accounts you might have etc.
bottom line... use a password manager!
|
|
|
|
Post by Admin on Jul 4, 2020 4:42:44 GMT
Trust me, use a password manager (which are free) and make a backup copy of the database and keep it somewhere safe. so this way even if your computer dies out of no where, you can easily restore your password managers database file. with a password manager all you have to do is remember one good password which will then give you access to each and every site you use to log into online and each will have a random/secure password. because it's very unwise to use the same so-so password across multiple websites, especially on stuff you care about like banking etc, because if someone gets a hold of a password through a website being compromised they could potentially use it to compromise other accounts you might have etc. bottom line... use a password manager! What are your thoughts on browsers' built-in password managers? |
|
|
|
Post by mslo79 on Jul 4, 2020 6:03:37 GMT
Admin I am not a fan (I never store anything in those). a proper password manager (of which there are a fair amount that are 100% free) is almost certainty better and more secure and it's easier to work with since it won't matter which browser your using since you just do a simple copy/paste with the right click of mouse from the password manager to the browser etc to sign into a any website you have stored in the password manager. also, I am generally not a fan of password managers that upload ones database online as you just never know how good their security is should someone happen to hack into their stuff etc. it's best to keep it local (as in on your hard drive etc) as then you got full control over things. if one does decide they want to make a backup of their password database to store somewhere online I suggest encrypting the already encrypted database with another encryption program or two with a really secure password (or passphrase (with stuff like 'Diceware')) that no one is going to crack should they get a hold of it if you make the password/passphrase long/secure enough. I personally have been using Password Safe (i.e. pwsafe.org/ ; which does not store ones password database online so it's on the user to make proper backups (it's only a small file so one can copy it to a few USB sticks etc for backup) so that does not get lost/damaged) for more than 10 years but probably somewhere around 13-15 years or so. it says, "Designed by renowned security technologist Bruce Schneier" ; but currently it's maintained by Rony Shaprio which I think Bruce Schneier personally knows if I recall correctly. it's secured by Twofish encryption which is one of the finalists back in the day before AES ultimately became the standard that many use for general encryption (basically AES/Twofish etc are secure). hell, that i5-3550 CPU I recently upgraded to from my i3-2120 CPU (for only $20) has hardware acceleration of AES encryption and it's quite noticeable to as running a quick benchmark test on VeraCrypt encryption program, on my i3-2120 the mean speed of AES was 295MB/s (which has no hardware acceleration of AES) but with the i5-3550 CPU, which does have hardware acceleration of AES, running that same test is around 3.1GB/s (3100MB/s). which basically means if one uses AES encryption on their device it will use much less CPU to process than it would with another encryption algorithm. even with Twofish on VeraCrypt on my i3-2120 CPU it did about 365MB/s where as on my i5-3550 it does around 813MB/s, so about twice as fast which is not surprising because the CPU is 200Mhz faster per core and I have double the cores (i.e. 4 instead of 2). another thing I noticed in Password Safe is you can actually tweak things a bit to make it harder for someone to brute force your password database should they ever get a hold of it. but it adds a small delay to opening of the database, but it's not that big of a deal if your CPU is good but on a laptop I got, since it's already underpowered, you can see there is a decent delay opening the database because it taxes the CPU a bit etc. basically the higher that MB/s and GB/s stuff is the less general CPU power it will take using something that's encrypted since those MB/s and GB/s numbers are when the CPU is topped out, like the max it can process stuff at. but to state the obvious... since we are talking about a password manager the speed it processes at is a non-issue since even slow CPU's, is good enough since it probably won't be more than a few seconds or so tops to open the database after the master password is entered and with Password Safe in it's default state it's secure and opening the database on the underpowered laptop I have (a backup computer) is easily good enough as it's not like one has to wait a year for it to open as even after I ramped up the option to make it harder to brute force the database, off the top of my head, it probably takes maybe a few seconds after I enter the password before the program opens and is usable. but in it's default state it is only a slight delay. but I believe I did tweak the default password generation options on Password Safe so the passwords are longer and uses more characters etc as one wants to avoid passwords that are too short and not complex enough. also, when someone uses a password manager, use a good password and I would suggest writing that password down and storing it somewhere so if you forget it, you can easily recover it. or if a person wants to use somewhat of a weaker password for their password manager, I would at least add some padding as it should make it noticeably more secure and should not be too hard for someone to remember either. like for example... "_-_-_My.So-So.Password.Here_-_-_". I would probably try to get a password at least 20 characters long for the master password of the password manager. or even a decent 5-6 word passphrase with a little padding etc. point is, whatever you use, don't put a master password that's too easy for someone else to guess. NOTE: Password Safe works on Windows and Linux and I think there is a android version available to but I never been a fan of doing anything important on a smart phone since they tend to be less secure than a proper computer as a general rule as proper computers get security updates much faster. I tend to view smartphones in general as something that's okay to do something quick online but I would not use them for doing anything important online. with all of that said... one can lookup something like 'free password managers' on Google as there is a fair amount to choose from. sorry for the novel  ; but in today's world it still amazes me some people use the same crappy password across multiple websites, especially on websites like banking etc as you don't want those falling into the wrong hands as that's what's good about a password manager as it gives you strong/unique/random/long password for each website you use, so even if one of the sites you use got hacked and your password to that site was compromised, it won't have any negative effect on the other websites you use since they all each have a different password and you don't even have to remember it since the password manager does it all for you. all you got to remember is the master password. so in other words... I don't even know ANY of the passwords to all of the sites I log into but I do know the master password to my password manager which then gives me access to the username/password combos for all of the sites I have accounts on.
|
|
|
|
Post by Admin on Jul 4, 2020 6:47:42 GMT
I am generally not a fan of password managers that upload ones database online as you just never know how good their security is should someone happen to hack into their stuff etc. How good does it need to be? You said if the need arises to store your database online, it should be encrypted. Does Mozilla, Microsoft, Google, etc not encrypt the saved login credentials? |
|
|
|
Post by mslo79 on Jul 5, 2020 7:12:05 GMT
Sending a file to say Google for example with the typical HTTPS connection is secure in that sense that no one can intercept the data you send to Google. but... it won't stop someone from potentially viewing it internally at Google (there are alternatives to Google like Protonmail etc) or if someone was to exploit a flaw to be able to gain access to someones account etc. but if you encrypt the file before sending it to say Google, they would have to break the encryption on the file itself to view it and you can be confident that won't happen if your password/passphrase is secure enough. so worse case... you upload a encrypted file to Google etc and someone shady immediately got a hold of it, they would still have to break the encryption on the file itself in order to view the sensitive data/info. basically I would not put too much trust in any random site to secure your data which is why if you do it yourself well, even if some shady person got a hold of the file, chances are they won't be able to view the data/info especially if your using a really secure password/passphrase (say a 10+ word Diceware passphrase etc) which will likely be secure for the foreseeable future.
if I were to upload anything online of higher importance I tend to take the more paranoid route... double or triple encrypt it AT LEAST. this way even if there was a flaw someone could exploit in one of the programs to bypass the encryption used, it would have to get through the others to which seems less likely that would happen that say 3-4 different encryption programs would all fail like that (unless there was a catastrophic failure in the encryption used, which is why it would not hurt to mix it up and use AES on some and Twofish on others if possible). but obviously you got to use different passwords/passphrases each time you encrypt to a different file. like for example... original password manager file(which is already encrypted) > Encryption Program A > Encryption Program B etc. so in this example, if you uploaded this file online, someone would have to break through the first two to attempt to break the password managers database. this might be a little overkill but it will increase the security of things at the trade off of convenience. I would imagine in general as long as the password managers 'master password' is quite secure, you probably would not have to opt for the double or triple encryption stuff I mentioned. but I thought I would mention it.
so to answer your question of, 'How good does it need to be?' ; depends on what your securing whether taking extra measures is worth it or not. but anything sensitive like banking etc it's better to be safe than sorry. but if someone is just securing a handful of passwords to websites that they don't care too much about, then you can pretty much do whatever you like since worst case scenario your not going to be all that upset over it.
with all of that said... at the very least, the common person should really be using a password manager to keep track of all of their sites they have accounts and login info to and then make a local backup(if not at least a couple of additional backups) of that file so it never gets lost or destroyed from ones computer crashing, they can easily restore things and all is good once again.
|
|
; but in today's world it still amazes me some people use the same crappy password across multiple websites, especially on websites like banking etc as you don't want those falling into the wrong hands as that's what's good about a password manager as it gives you strong/unique/random/long password for each website you use, so even if one of the sites you use got hacked and your password to that site was compromised, it won't have any negative effect on the other websites you use since they all each have a different password and you don't even have to remember it since the password manager does it all for you. all you got to remember is the master password. so in other words... I don't even know ANY of the passwords to all of the sites I log into but I do know the master password to my password manager which then gives me access to the username/password combos for all of the sites I have accounts on.